CVE-2026-47377

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description The client-side hashRedirect plugin in the packages/nc-gui/plugins/hashRedirect.client.ts file performs an insufficient check on paths extracted from the URL hash fragment. The plugin uses the startsWith('/') method to validate the hashPath variable before passing it to the window.location.replace() function. Because protocol-relative URLs (starting with //) also satisfy this condition, browsers interpret them as absolute URLs, allowing a crafted link to silently redirect users to an attacker-controlled origin. This open redirect does not require authentication and can be used to lead victims to pages that impersonate a login screen.

Recommendations Update to version 2026.04.1.